PT-2026-108055

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to web and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

PT-2026-107987

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

PT-2026-107827

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled...

PT-2026-107773

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...

PT-2026-108315

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An HTTP server handler improperly continues to read and serve requests from a connection after sending a 2xx response to an HTTP/1 CONNECT request without...

PT-2026-107839

Name of the Vulnerable Software and Affected Versions SecuShare Pro version 4 Description SecuShare Pro contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. OS Command Injection is a flaw where ...

PT-2026-108114

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff rtsp connect in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes,...

PT-2026-108036

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

PT-2026-107741

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...

PT-2026-107723

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

Important: bind9.16 security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

PT-2026-107977

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability in the distributed pixel cache server that allows connecting clients to overwrite heap memory by sending crafted data. Attackers can connect to the distributed pixel cache server and transmit malicious data to trigger a hea...

PT-2026-108312

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HTTP/2 server incorrectly refunds connection-level flow control twice for the same data. This occurs when a client resets a stream, refunding data for the...

CVE-2025-32433

CVE-2025-32433 Erlang/OTP SSH サーバーの重大な脆弱性により、認証なしのリモートコード実行 RCE が可能になります。この欠陥は SSH プロトコルのメッセージ処理メカニズムに存在し、攻撃者が認証情報を必要とせずに任意のコマンドを実行できるようにします。 影響 重大な脆弱性であり、攻撃者が以下のことを行える可能性があります: - ブラウザのサンドボックス保護の回避 - 任意のコードの実行 - システムの整合性の侵害 - システムリソースへの不正アクセス この脆弱性は特に Windows 上の Firefox を標的としており、実際に悪用されていました。SSH...

[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-22slack15.0.txz: Rebuilt. This update fixes security issues: XKB SetGeometry TextDoodad Double Free...

CVE-2024-40725

HTTP Request Smuggling 감지 도구 이 저장소는 HTTP Request Smuggling 취약점을 탐지하는 Python 기반 도구를 포함하며, 특히 CVE-2024-40725를 대상으로 합니다. 이 도구는 조작된 HTTP 요청을 보내고 서버의 응답을 분석하여 Apache HTTP Server에서 이 취약점을 악용하려고 시도합니다. 주된 목표는 특정 경로에 대한 제한을 우회하는 등 상태 코드나 접근 동작의 차이를 식별하는 것입니다. 기능 HTTP Request Smuggling 취약점 탐지 단일 URL 테스트 및...

confusploit

CVE-2022-26134 の脆弱性があるサーバーを探すためのスクリプトで、SHODAN CLI や Bash スクリプトのワンライナーと一緒に使用できます 法的および教育目的でのみ使用してください OGNL インジェクションによる Confluence の事前認証リモートコード実行 CVE-2022-26134 2022年6月2日、Atlassian は Confluence Server および Data Center アプリケーションに関するセキュリティアドバイザリを公開し、深刻度が重大な未認証のリモートコード実行の脆弱性を強調しました。この OGNL...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 1단계: 데모 취약 웹 앱 LAB 우리는 CVE-2025-55182와 유사한 로직안전하지 않은 서버 측 실행을 생성합니다. 📁 vulnapp/app.py from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data = request.json.get"component" ❌ VULNERABLE: user input to command execution result =...